M1 slice 2: amicode service — vault family (vaults, warrants, vault-browser, file-resolve)

packages/extension/scripts/amicode_fixture_seed.mjs

@@ -12,8 +12,8 @@
 //   - memory note mtimes are pinned via utimesSync so remembers()' recency
 //     tiebreak is stable across seedings.
 //   - every value (names, dates, fidelities) is fixed data, never Date.now().
-import { mkdirSync, writeFileSync, utimesSync } from "node:fs";
-import { join } from "node:path";
+import { chmodSync, mkdirSync, writeFileSync, utimesSync } from "node:fs";
+import { dirname, join } from "node:path";
 
 export function seedAmicodeSandbox(dir) {
   const amico = join(dir, ".amico");
@@ -104,10 +104,74 @@ export function seedAmicodeSandbox(dir) {
   run("r20260810-3d4e5f", {}); // unfinished — no result.toml
   run("r20260815-6a7b8c", { "result.toml": "fidelity = 0.9999\n" });
 
+  // --- vaults (the vault family: mounts with the marker taxonomy) --------------
+  const vaults = join(dir, "vaults");
+  const mount = (base, marker, files) => {
+    const d = join(vaults, base);
+    mkdirSync(d, { recursive: true });
+    writeFileSync(join(d, ".amico-vault.toml"), marker);
+    for (const [f, content] of Object.entries(files ?? {})) {
+      const p = join(d, f);
+      mkdirSync(dirname(p), { recursive: true });
+      writeFileSync(p, content);
+    }
+  };
+  // personal: browsable by default. Sizes are fixed → deterministic listing.
+  mount("personal-main", 'kind = "personal"\nname = "personal-main"\n', {
+    "welcome.md": "# Welcome\n\nVault knowledge base.\n",
+    "notes/note.md": "Note body — deterministic.\n",
+    "data/binary.bin": "\u0000\u0001\u0002binary",
+  });
+  // team WITHOUT browse=true: the fail-closed refusal fixture (opts in for
+  // nothing; listing it must refuse).
+  mount("team-shared", 'kind = "team"\nname = "team-shared"\n', {});
+  // public: browsable by definition.
+  mount("public-open", 'kind = "public"\nname = "public-open"\n', {
+    "pub.md": "Public note.\n",
+  });
+
+  // attachable vault OUTSIDE the vaults root (POST /amicode/vaults path flavor
+  // symlinks it in) — its appearance in the post-attach listing pins the
+  // status-cache bust.
+  const attachable = join(dir, "attachable-demo");
+  mkdirSync(attachable, { recursive: true });
+  writeFileSync(join(attachable, ".amico-vault.toml"), 'kind = "personal"\nname = "attached-demo"\n');
+  writeFileSync(join(attachable, "attached.md"), "Attached vault note.\n");
+
+  // --- ledger (warrants: one approval + two solves under its plan) --------------
+  const ledger = join(amico, "ledger");
+  mkdirSync(ledger, { recursive: true });
+  const planHash = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
+  writeFileSync(
+    join(ledger, "runs.jsonl"),
+    [
+      JSON.stringify({ type: "approval", plan_hash: planHash, bounds: { max_solves: 3, tier: "free" }, expires_at: "2026-12-31T00:00:00Z", issued_by: "user:cli" }),
+      JSON.stringify({ type: "solve", plan_hash: planHash, run_id: "r20260801-0a1b2c" }),
+      JSON.stringify({ type: "solve", plan_hash: planHash, run_id: "r20260815-6a7b8c" }),
+      JSON.stringify({ type: "approval", plan_hash: "cafebabecafebabecafebabecafebabecafebabe", bounds: {}, expires_at: "2026-09-30T00:00:00Z", issued_by: "user:ui" }),
+      "this line is not json", // per-line tolerance: one bad line must not blind the card
+      "",
+    ].join("\n"),
+  );
+
+  // --- stub PATH: `amico` exists (fixed output → deterministic approve fixture),
+  //     `amico-vault` does NOT (forces the CLI-less scanMounts path on both
+  //     sides, so fixtures never depend on a real CLI being installed). ----------
+  const stubbin = join(dir, "stubbin");
+  mkdirSync(stubbin, { recursive: true });
+  writeFileSync(join(stubbin, "amico"), "#!/bin/sh\necho 'stubbed approve ok'\n");
+  chmodSync(join(stubbin, "amico"), 0o755);
+
+  // --- project dir (tier-4 relative resolution resolves against it) ------------
+  mkdirSync(join(dir, "docs"), { recursive: true });
+  writeFileSync(join(dir, "docs", "readme.md"), "Project readme.\n");
+
   // --- the env overlay both sides use ------------------------------------------
   // AMICODE_MOUNTS_FILE is the port's test seam (the fork resolves HOME only;
   // the recorder ALSO redirects HOME to the sandbox, so both sides read the
-  // same mounts.toml through different mechanisms).
+  // same mounts.toml through different mechanisms). PATH is pinned to the
+  // stub dir on BOTH sides (fork spawn + test process) so CLI discovery and
+  // `amico ledger approve` behave identically regardless of the host machine.
   return {
     dir,
     env: {
@@ -116,6 +180,10 @@ export function seedAmicodeSandbox(dir) {
       AMICODE_MEMORY_DIR: memory,
       AMICODE_PROBLEMS_DIR: problems,
       AMICODE_RUNS_DIR: runs,
+      AMICO_VAULTS_ROOT: vaults,
+      AMICO_LEDGER: join(ledger, "runs.jsonl"),
+      AMICODE_PROJECT_DIR: dir,
+      PATH: stubbin,
     },
   };
 }

packages/extension/scripts/record_amicode_fixtures.mjs

@@ -15,13 +15,13 @@
 //
 // Binary resolution: --binary > repo vendored copy > newest installed VSIX.
 import { spawnSync, spawn } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
 import { seedAmicodeSandbox } from "./amicode_fixture_seed.mjs";
 
 const PKG_ROOT = join(import.meta.dirname, "..");
-const FIXTURE_OUT = join(PKG_ROOT, "test", "fixtures", "amicode", "profile.json");
+const FIXTURE_OUT = join(PKG_ROOT, "test", "fixtures", "amicode", "golden.json");
 
 function resolveBinary(flag) {
   if (flag) {
@@ -57,6 +57,63 @@ const REQUESTS = [
   { method: "POST", path: `/amicode/profile?focus=${encodeURIComponent("Rydberg blockade")}`, name: "edit focus" },
   { method: "POST", path: "/amicode/profile?name=", name: "clear name — mounts.toml fallback fires" },
   { method: "GET", path: "/amicode/profile", name: "warm read — post-save state" },
+  // ── vault family (slice 2) ──────────────────────────────────────────────────
+  // The {SANDBOX} placeholder is substituted with the recording sandbox dir at
+  // request time (test bodies embed absolute paths); responses carrying the
+  // sandbox dir are normalized against meta.sandbox in the replay.
+  { method: "GET", path: "/amicode/vaults", name: "vaults — CLI-less scan (mounts, kind order)" },
+  {
+    method: "POST",
+    path: "/amicode/vaults",
+    body: { ref: "{SANDBOX}/attachable-demo" },
+    name: "attach local vault (symlink flavor)",
+  },
+  { method: "GET", path: "/amicode/vaults", name: "vaults — post-attach (cache bust, new mount)" },
+  { method: "GET", path: "/amicode/vault-files?mount=personal-main", name: "browse personal mount (flat listing)" },
+  { method: "GET", path: "/amicode/vault-files?mount=team-shared", name: "browse team mount — fail-closed refusal" },
+  {
+    method: "GET",
+    path: "/amicode/vault-file?mount=personal-main&path=notes%2Fnote.md",
+    name: "read one file in mount",
+  },
+  {
+    method: "GET",
+    path: "/amicode/vault-file?mount=personal-main&path=data%2Fbinary.bin",
+    name: "read non-text file — not_text refusal",
+  },
+  {
+    method: "GET",
+    path: "/amicode/vault-file?mount=personal-main&path=..%2F..%2Fattachable-demo%2Fattached.md",
+    name: "traversal attempt — escape refusal",
+  },
+  { method: "GET", path: "/amicode/warrants", name: "warrants — ledger read (solves_used + corrupt-line tolerance)" },
+  { method: "POST", path: "/amicode/approve", body: { plan_hash: "abc123" }, name: "approve via stub amico (success)" },
+  { method: "POST", path: "/amicode/approve", body: "not json", name: "approve — bad body refusal" },
+  {
+    method: "GET",
+    path: `/amicode/resolve-file?path=${encodeURIComponent("{SANDBOX}/docs/readme.md")}`,
+    name: "resolve absolute path (tier 1)",
+  },
+  {
+    method: "GET",
+    path: `/amicode/resolve-file?path=${encodeURIComponent("personal-main/notes/note.md")}`,
+    name: "resolve mount-prefixed (tier 3)",
+  },
+  {
+    method: "GET",
+    path: `/amicode/resolve-file?path=${encodeURIComponent("docs/readme.md")}`,
+    name: "resolve relative w/ dir part (tier 4 → project dir)",
+  },
+  {
+    method: "GET",
+    path: `/amicode/resolve-file?path=${encodeURIComponent("insight-nothing.md")}`,
+    name: "resolve bare typed-prefix — miss (tier 5)",
+  },
+  {
+    method: "GET",
+    path: `/amicode/resolve-file?path=${encodeURIComponent("https://example.com/x")}`,
+    name: "resolve scheme-ful string — not a file ref",
+  },
 ];
 
 async function main() {
@@ -106,10 +163,36 @@ async function main() {
 
   const entries = [];
   for (const req of REQUESTS) {
-    const r = await fetch(base + req.path, { method: req.method, headers: { Authorization: auth } });
-    const body = await r.text();
-    entries.push({ name: req.name, request: { method: req.method, path: req.path }, status: r.status, body });
-    console.log(`[record] ${req.method} ${req.path} → ${r.status} (${body.length} bytes)`);
+    // {SANDBOX} substitution: request paths/bodies embed the recording sandbox.
+    const path = req.path
+      .replaceAll("{SANDBOX}", sandbox)
+      .replaceAll(encodeURIComponent("{SANDBOX}"), encodeURIComponent(sandbox));
+    const body =
+      req.body === undefined
+        ? undefined
+        : typeof req.body === "string"
+          ? req.body
+          : JSON.stringify(
+              JSON.parse(JSON.stringify(req.body), (_k, v) => (typeof v === "string"
+                ? v.replaceAll("{SANDBOX}", sandbox)
+                : v)),
+            );
+    const r = await fetch(base + path, {
+      method: req.method,
+      headers: { Authorization: auth, ...(body !== undefined ? { "Content-Type": "application/json" } : {}) },
+      body,
+    });
+    const respBody = await r.text();
+    // Record the request with {SANDBOX} restored so the replay re-substitutes
+    // ITS sandbox; the RESPONSE is stored as-served (normalization happens at
+    // replay, against meta.sandbox below).
+    entries.push({
+      name: req.name,
+      request: { method: req.method, path: req.path, ...(req.body !== undefined ? { body: req.body } : {}) },
+      status: r.status,
+      body: respBody,
+    });
+    console.log(`[record] ${req.method} ${path} → ${r.status} (${respBody.length} bytes)`);
   }
 
   child.kill("SIGTERM");
@@ -119,7 +202,20 @@ async function main() {
   const manifest = JSON.parse(readFileSync(join(PKG_ROOT, "opencode.lock.json"), "utf8"));
   writeFileSync(
     FIXTURE_OUT,
-    JSON.stringify({ recordedAt: new Date().toISOString(), fork: { version, tag: manifest.tag }, entries }, null, 2) + "\n",
+    JSON.stringify(
+      {
+        recordedAt: new Date().toISOString(),
+        fork: { version, tag: manifest.tag },
+        // The recording sandbox dir (and its realpath — responses embed both
+        // forms: unresolved joins and realpathSync'd results). The replay
+        // normalizes these to <SANDBOX> on both sides before comparing.
+        sandbox: sandbox,
+        sandboxReal: realpathSync(sandbox),
+        entries,
+      },
+      null,
+      2,
+    ) + "\n",
   );
   console.log(`[record] wrote ${FIXTURE_OUT} (${entries.length} entries)`);
   rmSync(sandbox, { recursive: true, force: true });

packages/extension/src/amicode_service/bind_host.ts

@@ -0,0 +1,30 @@
+// AMICODE SERVICE (#451): the loopback gate shared by the vault-browser and
+// credentials surfaces. isLoopbackHostname is ported VERBATIM from the fork's
+// connections.ts @ v1.18.10-amicode.11 (same 127/8 + v4-mapped families); the
+// bind hostname is stamped by the service at listen time (the extension-host
+// service binds 127.0.0.1 by construction — the seam exists so a future
+// non-loopback bind keeps the fail-closed law honest).
+
+let bindHostname: string | undefined;
+
+/** Stamp the bind hostname (call once, at listen). */
+export function setBindHostname(host: string | undefined): void {
+  bindHostname = host;
+}
+
+/** The current bind hostname — shared with the vault-browser routes, whose
+ *  loopback gate rides the same signal as the credential-mutation guard. */
+export function getBindHostname(): string | undefined {
+  return bindHostname;
+}
+
+/** Same loopback family the mdns gate recognizes (server.ts), widened to the
+ *  whole 127/8 block and the v4-mapped form. undefined = in-process handler. */
+export function isLoopbackHostname(hostname: string | undefined): boolean {
+  if (hostname === undefined) return true;
+  const host = hostname.toLowerCase();
+  if (host === "localhost" || host === "::1") return true;
+  if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host)) return true;
+  if (host.startsWith("::ffff:127.")) return true;
+  return false;
+}